FS-10388: [core] fix crash on shutdown when using multiple meida bugs

diff --git a/src/switch_core_media_bug.c b/src/switch_core_media_bug.c
index e14c72026e608040c65eeee7aa29ce9b3f138f0e..808720fa2bb67b202c5c57a63670c16664a953da 100644 (file)
--- a/src/switch_core_media_bug.c
+++ b/src/switch_core_media_bug.c
@@ -1220,8 +1220,8 @@ SWITCH_DECLARE(switch_status_t) switch_core_media_bug_remove_all_function(switch
        switch_status_t status = SWITCH_STATUS_FALSE;
        switch_media_bug_t *closed = NULL;
 
+       switch_thread_rwlock_wrlock(session->bug_rwlock);
        if (session->bugs) {
-               switch_thread_rwlock_wrlock(session->bug_rwlock);
                for (bp = session->bugs; bp; bp = next) {
                        next = bp->next;
 
@@ -1248,12 +1248,13 @@ SWITCH_DECLARE(switch_status_t) switch_core_media_bug_remove_all_function(switch
 
                        switch_core_media_bug_close(&bp, SWITCH_FALSE);
                }
-               switch_thread_rwlock_unlock(session->bug_rwlock);
                status = SWITCH_STATUS_SUCCESS;
        }
+       switch_thread_rwlock_unlock(session->bug_rwlock);
 
+               
        if (closed) {
-               for (bp = session->bugs; bp; bp = next) {
+               for (bp = closed; bp; bp = next) {
                        next = bp->next;
                        switch_core_media_bug_destroy(&bp);
                }
@@ -1405,7 +1406,7 @@ SWITCH_DECLARE(uint32_t) switch_core_media_bug_prune(switch_core_session_t *sess
 
 SWITCH_DECLARE(switch_status_t) switch_core_media_bug_remove_callback(switch_core_session_t *session, switch_media_bug_callback_t callback)
 {
-       switch_media_bug_t *cur = NULL, *bp = NULL, *last = NULL, *closed = NULL;
+       switch_media_bug_t *cur = NULL, *bp = NULL, *last = NULL, *closed = NULL, *next = NULL;
        int total = 0;
 
        switch_thread_rwlock_wrlock(session->bug_rwlock);
@@ -1433,9 +1434,11 @@ SWITCH_DECLARE(switch_status_t) switch_core_media_bug_remove_callback(switch_cor
                        }
                }
        }
-
+       switch_thread_rwlock_unlock(session->bug_rwlock);
+       
        if (closed) {
-               for (bp = session->bugs; bp; bp = bp->next) {
+               for (bp = closed; bp; bp = next) {
+                       next = bp->next;
                        switch_core_media_bug_destroy(&bp);
                }
        }
@@ -1444,9 +1447,6 @@ SWITCH_DECLARE(switch_status_t) switch_core_media_bug_remove_callback(switch_cor
                switch_core_codec_destroy(&session->bug_codec);
        }
 
-       switch_thread_rwlock_unlock(session->bug_rwlock);
-
-
        return total ? SWITCH_STATUS_SUCCESS : SWITCH_STATUS_FALSE;
 }